Get Your CertGoogle Cloud Associate Cloud EngineerPlayCompete
‹ All Google Cloud Associate Cloud Engineer questions

GCP Associate Cloud Engineer Practice Question 22: Cloud NAT Private VMs

Google Cloud Associate Cloud Engineer · Test 3 · question 2 of 10

VPC Networkingeasy

VMs in a private subnet have no external IP addresses. They must download operating system patches from a third party repository on the internet, but nothing on the internet should be able to initiate a connection to them.

What should you configure?

Select one answer
Show answer and explanation

Answer:

  • A. A Cloud NAT gateway, together with a Cloud Router, in the region of the subnet

Cloud NAT provides outbound network address translation for VMs that have no external IP addresses. It only allows replies to connections that the VMs initiate, so the instances can reach the internet while remaining unreachable from it. It is configured on a Cloud Router in the region.

Option B works technically, but assigning external IP addresses is what you want to avoid, and it increases the attack surface and cost. Option C only enables access to Google APIs and services, not to arbitrary third party sites. Option D is not possible with a third party internet repository, which is not a VPC network you can peer with.

Reference: Cloud NAT overview

Practice Test 3 ›

Study guides for Google Cloud Associate Cloud Engineer

Google Cloud Digital Leader exam: what's on it, who it's forGoogle Cloud Digital Leader: August 2026 exam update, six sections, US$99 price as of November 2026, renewal, study plan and ACE comparison.
Free cloud certifications in 2026: which are really freeWhich free cloud certifications are really free in 2026: Oracle's free OCI exams, and the voucher routes for AWS, Microsoft and Google, with prices.
Which cloud certification is best? AWS vs Azure vs GoogleWhich cloud certification is best for a beginner? AWS Cloud Practitioner, AZ-900 and Google Cloud Digital Leader compared: cost, format and which first.
Google Cloud certification path: is ACE worth it?Is Google's Associate Cloud Engineer certification worth it? The Google Cloud certification path in 2026, with cost, format and which exam to take first.
GCP IAM roles, service accounts and keyless accessBasic, predefined and custom roles in Google Cloud IAM, how grants inherit down the hierarchy, and how to use service accounts without keys.